2.6.28-stable review patch. If anyone has any objections, please let us know.

------------------

From: NeilBrown <neilb@suse.de>

commit 73d5c38a9536142e062c35997b044e89166e063b upstream.

There has been a race in raid10 and raid1 for a long timewhich has only recently started showing up due to a scheduler changed.

When a sync_read request finishes, as soon as reschedule_retryis called, another thread can mark the resync request as havingcompleted, so md_do_sync can finish, ->stop can be called, and->conf can be freed. So using conf after reschedule_retry is notsafe.

Similarly, when finishing a sync_write, calling md_done_sync must bethe last thing we do, as it allows a chain of events which will freeconf and other data structures.

The first of these requires action in raid10.cThe second requires action in raid1.c and raid10.c